CVE-2026-33190: CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC

CoreDNS’ tsig plugin can be bypassed on non-plain-DNS transports because it trusts the transport writer’s TsigStatus() instead of performing verification itself. In the attached PoC, plain DNS/TCP correctly rejects an invalid TSIG (NOTAUTH), while the same invalid-TSIG request is accepted over DoT (tls://) and DoH (https://), allowing a client without the shared secret to satisfy require all. The same bug class affects DoH3, DoQ, and gRPC.